CVE-2020-13227: 
Sysax Multi Server vulnerability analysis and mitigation

An issue was discovered in Sysax Multi Server 6.90 that allows attackers to determine the username under which the web server is running by triggering an invalid path permission error. This vulnerability (CVE-2020-13227) effectively bypasses the fakepath protection mechanism that is intended to prevent such information disclosure (GitHub Advisory).

The vulnerability exists in the error handling mechanism of the web server component. When an attacker attempts to access a folder without proper permissions through the web interface using a specially crafted URL with the format '/scgi?sid=[session_id]&pid=transferpage2_name1_[folder_name].htm', the server reveals the username under which it is running in the error message (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthorized users to obtain sensitive information about the server's configuration, specifically the username under which the web server process is running. This information could be leveraged in further attacks or privilege escalation attempts (GitHub Advisory).

The vulnerability is easily exploitable by sending a specially crafted HTTP request to the affected server. A proof of concept exploit has been published that demonstrates how to trigger the information disclosure by accessing an invalid path through the web interface (GitHub Advisory).

The vulnerability affects Sysax Multi Server version 6.90. Users should upgrade to a patched version if available. If upgrading is not immediately possible, administrators should implement additional access controls and monitoring to detect and prevent unauthorized access attempts (NVD).